32.3.11-18Scalar Crypto III: Key Schedule & Bitmanip-for-Crypto

Part III Linux boot: optional Vol. I (Unprivileged) pp. 398–405 · ~2 min read

This span of the alphabetical reference finishes AES key expansion, then re-lists the crypto bitmanip instructions — the same encodings the bitmanip chapter defines, gathered here because Zbkb/Zbkc/Zbkx are components of the Zk suites.

aes64ks2 through packh
Cryptographic roleDefined in
aes64ks2Combines the aes64ks1i output with prior key words (the XOR chain) to emit the next round-key pair — the second half of AES-64 key expansion.Zknd + Zkne (this chapter)
andn / orn / xnorMasking and GF arithmetic helpers; the inverted-operand logicals cut instruction counts in bit-sliced ciphers.Zbkb (u30)
brev8Bit-reverse within bytes — GHASH bit-reflection and endianness fixups for hash message schedules.Zbkb (u30)
clmul / clmulhCarry-less multiply — the GHASH/GCM core, kept in its own Zbkc extension for the multiplier cost.Zbkc (u30)
pack / packhAssemble wide values from byte/half lanes — bit-slicing and endianness marshalling.Zbkb (u30)
Dotted-underlined cells have explanations — click one.

The remaining bitmanip-for-crypto instructions — packw, rev8, rol/rolw/ror/rori/roriw/rorw (the SHA/ChaCha rotate family), unzip/xnor/xperm8/xperm4/zip — continue into the next reference span and are documented in full on the bitmanip pages. Their cryptographic uses: rotates drive SHA-2’s Σ/σ and every ARX cipher, xperm builds constant-time SBoxes, zip/unzip emulate 64-bit permutations on RV32.

Hardware Designer Notes

Nothing new in silicon here beyond the ks pair (a rotate + SBox + Rcon ROM + XOR): the bitmanip instructions are literally the u30 datapath. The chapter’s value is the mapping from cryptographic primitive to instruction, which the reference tables make explicit.

Minimal Linux-boot hart MUST

  • Implement aes64ks1i/ks2 as the RotWord/SubWord/Rcon + XOR-combine pair, sharing the AES SBox with the round instructions
  • Route the shared bitmanip-crypto instructions through your existing Zbb/Zbc datapath — no separate crypto copies

MAY simplify / trap-and-emulate

  • Handle the AES-256 special key-schedule case (the immediate value that suppresses Rcon and RotWord) in aes64ks1i decode

Check yourself — key schedule & bitmanip crypto

1.aes64ks1i takes a round-number immediate. What does it compute?

2.Why do the crypto bitmanip instructions (rol, ror, andn, pack, brev8, clmul, xperm…) appear in THIS chapter when they're defined in the bitmanip chapter?

2 questions